Sauter modulo 6 devices modu680-AS vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Sauter modulo 6 devices modu680-AS: 6 record(s), with affected versions and fixes.
CVE-2025-41724
High · 7.5
CWE-239 Oct 22, 2025
Sauter: Crash via Incomplete SOAP Request
An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.
CVE-2025-41723
Critical · 9.8
CWE-35 Oct 22, 2025
Sauter: Directory Traversal in importFile SOAP Method
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.
CVE-2025-41722
High · 7.5
CWE-798 Oct 22, 2025
Sauter: Hard-coded Authentication Credentials
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.
CVE-2025-41721
Low · 2.7
CWE-77 Oct 22, 2025
Sauter: Command Injection
A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate.
CVE-2025-41720
Medium · 4.3
CWE-646 Oct 22, 2025
Sauter: Arbitrary File Upload
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.
CVE-2025-41719
High · 8.8
CWE-1286 Oct 22, 2025
Sauter: Improper Validation of user-controlled data
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password.